The In-Depth Guide to Fraud Prevention in International E-commerce

Transcription

1 The In-Depth Guide to Fraud Prevention in International E-commerce The Evolution of Fraud Cyberattacks are not a new threat, yet the rise in high-profile hacking cases has merchants rightfully concerned about fraud and their ability to protect their own interests as well as their customers sensitive payment information. While no merchant is entirely immune, there are a number of ways merchants of all sizes and verticals can combat fraud and prevent it from impacting their business and customer loyalty. To prepare for and prevent fraud, merchants must be aware of the factors that increase risk, integrate technology capable of detecting anomalous activity, and address the specific problems contributing to fraud within their businesses.

2 Awareness: Pinpoint the Problems As with most problems, the first step towards a solution is identifying the precise cause of the fraud. The number of vulnerabilities a merchant faces is infinite and constantly evolving, so this paper will focus on the three threats most relevant to merchants today: user experience, global reach, and social networking. User Experience Providing the best user experience is of primary concern to every retailer, but enhancing the security of one s offering often comes at the expense of a pristine experience. Uber, for instance, has argued that even simple two-factor authentication negatively affects its conversion rate. The more personal details a customer is required to provide at the onset of a payment, the more secure the transaction. However, were retailers to require such timeconsuming information input, it would destroy the user experience, drive most shoppers to abandon before checkout, and discourage return visits to the site. Global Reach The second major challenge facing retailers today is their global reach. Secure e-commerce is much easier to attain when transacting within one s own borders, but considering the massive revenue potential of global Internet retailing, merchants are opting to sell abroad despite the risks. Often, merchants are unaware that each country has its own payment methods and banking systems, and that the fraud mitigation methods that work in one s home nation may not apply to other regions. Social Networking Finally, retailers are faced with the challenge of protecting consumers who themselves are unwittingly enabling fraudster activity through their social networking behaviors. Today s consumers are so comfortable sharing personal information over social media that they do not realize the details they post can be found and maliciously used by fraudsters. An experienced fraudster can scan social media profiles and easily find information like a user s address, maiden name, living situation, and daily schedule all details that can be used to commit fraud. Merchants can hardly expect to control what their customers share about themselves online, but are still burdened with the task of identifying fraudulent activity. Luckily, many technologies have been developed to enable retailers to detect fraud in cases like these. As fraudsters become more sophisticated and the opportunities for fraud more prevalent, retailers must prepare themselves to combat these new challenges by learning about and choosing the right tools to detect and prevent fraud. 2

3 Detection: Choose the Right Fraud Detector Every worthwhile fraud detection tool is based on four detection algorithms that, working together, achieve the best results. Each practice on its own can be effective, but only to a certain degree. The benefit of relying on multiple fraud detection practices is that, by cross-referencing the transactions identified as fraud by each algorithm, the system can more accurately distinguish between true fraud and false positives. Although the algorithms discussed here can be used by any business, each will define rules differently based on the nature of the business (i.e. whether it only sells over mobile channels or across all channels; whether its transaction amounts are high or low; whether its products are virtual or physical). By customizing these four algorithms, merchants can better meet the unique needs of their business and mitigate fraud without impacting business activities. Static Rules The first type of test your detector should rely on is static rules: defined rules that detect and decline fraudulent charges across the board. This can mean automatically flagging large payments from certain countries or major transactions made at specific hours of the day or night; as well as velocity rules, such as when a consumer tries to make multiple purchases within a short amount of time. Using these rules, the fraud detection engine can define the degree to which an activity is risky and react accordingly. Behavioral Engines Behavioral engines are sets of dynamic rules that a detector creates for specific users. Once the fraud detection tool creates the user profile, it can detect when the user displays anomalous behavior. For instance, if a specific user has been buying merchandise for his or her business from a single IP address, but suddenly initiates a transaction from a different IP address or country than usual, the fraud detector will flag the transaction as potentially fraudulent. 3

4 Device Fingerprinting Another important parameter leveraged by fraud detection tools is device fingerprinting, a means by which recognized devices associated with previous purchases are used to authenticate user identity and prevent fraud. Once a device proves trustworthy, the fraud detection service will identify the device as reliable in future cases. By the same token, devices regarded as suspicious or which have yet to be used by the specific user will be regarded with caution and flagged as potentially fraudulent. Cross-Network Referencing The last algorithm leveraged by fraud tools is cross-network referencing, which is based on the idea that the fraudulent activity observed in one merchant s interactions can help protect other businesses using the same anti-fraud technology, even if they offer a completely different service and have an entirely different customer base. For example, if a fraud detection tool is used by both a fashion retailer and a technology provider, it can use information gleaned from the fashion retailer s interactions to protect the technology provider. If a particular IP address is associated with fraud for one retailer in the network, for instance, the fraud detector will protect other customers in its network against attacks or requests from that IP address. 4

5 Solution: Implement Prevention Strategies In addition to integrating the proper technology to ward off fraud, there are simple solutions merchants can implement to address the previously discussed issues of user experience, globalization, and social networking. For instance, while retailers cannot make excessive demands of customers in order to authenticate their identities, they can implement secure multi-factor authentication protocols and further secure these processes with tokenization. Apple Pay, for example, uses tokenization technology to streamline customer authentication and purchasing without harming the security of the transaction. With tokenization, no credit card information is stored on the device. Instead, the technology generates a single-use, sixteen digit number for each transaction. Since only the credit card network can trace the transaction back to the corresponding account, the sixteen digit code is useless to fraudsters. Similarly, cross-border merchants can protect their customers by establishing relationships with acquirers and e-wallets in each region where they want to conduct business. This will ensure that they comply with the security features, risks and payment standards of the regions within which they operate. Finally, merchants should integrate risk management solutions that mitigate and evaluate risk for suspicious transactions. Companies such as Feedzai use various algorithms and fraud detection methods (including static rules, behavioral engines, device fingerprinting, and cross-network referencing, among others) to identify questionable orders and provide merchants with recommendations regarding whether to approve or decline each transaction, while other solutions such as Riskified shift the chargeback liability from the merchant to themselves, covering the fee for any fraudulent charges they fail to identify. Adaptability: The Ultimate Protective Measure While there is no one security vendor that can solve all the problems retailers face today, awareness about the factors contributing to fraud, the solutions available to protect against it and easily implementable strategies for reducing risk are necessary for securing payment processes for both the retailer and the consumer. Merchants must be not only vigilant, but flexible and willing to evolve with security developments over time in order to provide the utmost protection for themselves and their customers. 5

6 About Zooz Zooz provides a payments platform designed to help merchants maximize their payments performance. It offers the flexibility to connect with multiple financial institutions, seamlessly integrate acquirers, e-wallets, alternative payment methods, fraud management and other third-party services, and intelligently route transactions through the entire payment process. Zooz consolidates and analyzes all payment data to provide valuable information to merchants, enabling them to personalize customer experiences online and in-store. It is the partner of choice for any business seeking to extend reach, reduce decline rates, increase revenues, maintain strong customer relationships and meet the challenges of the dynamic global market. For further information please go to Contact: US Office UK Office +44-(0) Israel R&D Center +972-(0) Zooz. All rights reserved. All figures are based on proprietary Zooz data